Three-party d-level quantum secret sharing protocol 
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We develop a three-party quantum secret sharing protocol based on arbitrary dimensional quan- 
tum states. In contrast to the previous quantum secret sharing protocols, the sender can always 
control the state, just using local operations, for adjusting the correlation of measurement directions 
of three parties and thus there is no waste of resource due to the discord between the directions. 
Moreover, our protocol contains the hidden value which enables the sender to leak no information 
of secret key to the dishonest receiver until the last steps of the procedure. 



PACS numbers: 03.67.Hk, 03.67.Dd 



I. INTRODUCTION 

In classical secret sharing 0, 0], one party, say Alice, 
wants to send her message to the other parties (Bob and 
Charlie) at a distance. However Alice suspects that one 
of the others may be dishonest, and she does not know 
who is the dishonest one. She tries to divide the se- 
cret message into two pieces and give the proper relation 
between them so that Bob and Charlie can decode the 
message only if they cooperate in the same place. 

Hillery et al. [3] first proposed a quantum secret shar- 
ing scheme with a tripartite entangled state called the 
Greenberger-Horne-Zeilinger (GHZ) state [4|, which was 
generalized into quantum secret sharing (QSS) protocols 
on any higher dimensional systems using a A-party N- 
level singlet state of total spin zero ||. However, the 
protocols still have the restriction that the number of 
participants should be the same as the dimension of each 
particle. 

In this paper we construct a QSS protocol which does 
not have such a limit, and which contains a hidden value 
controlling the correlation among outcomes of three par- 
ties. Moreover, we show that our protocol based on GHZ- 
like states can be more efficient than any previous QSS 
protocols, by allowing Alice to manage and to rotate the 
states locally according to the measurement directions of 
Bob and Charlie. 

Most of quantum cryptographic protocols assure that 
malicious eavesdropper cannot get the exact information 
about private key and can be detected with a specific 
probability when she measures a given state in the wrong 
direction. Thus, in order for QSS protocols to be se- 
cure, Eve's wrong measurement should give rise to un- 
certainty as much as possible. On this account, two mu- 
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tually unbiased basis (MUB) measurements [f| 0, Q on 
d-dimensional quantum systems play an important role 
in our protocol. 

In Section [II] we consider the generalized Pauli opera- 
tors acting on d-dimensional systems, and derive MUBs 
and the GHZ-like states. We provide our QSS protocol 
based on the GHZ-like states in Section lHl| and analyze 
the security of the protocol for two cases of attacks in 
Section IIV1 where one is an eavesdropping by Eve, and 
the other is the intercept-and-resend attack by dishonest 
person. We finally summarize our results in Section fVl 



II. GHZ-LIKE STATES ON d-DIMENSIONAL 
QUANTUM SYSTEMS 

In this section, we derive two MUBs and GHZ-like 
states on d-dimensional quantum systems, and investi- 
gate their properties related with the security of our pro- 
tocol. First, we consider the generalized Pauli operators 
acting on (i-dimensional Hilbert space. 

x = j2\j+m, z=^\j)(j\, a) 

3=0 3=0 

Y = XZ = J2" j \3 + m, (2) 

3=0 

where lu — e 27ri / d is a primitive d-th root of unity. Let 



3=0 



(3) 



Then \k x ) is an eigenstate of X with eigenvalue u> . Let 



d-1 
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— J2^ J ~i J \j) if d is odd, 



3=0 
d-l 



1 \ - j 2 -2fcj-2j 
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Then \k y ) is an eigenstate of Y with eigenvalue u k if d is 
odd and with eigenvalue Lo k yfw if d is even. 

For each d, the set of eigenstates {\k x ) : k S Z^} of X 
forms an orthonormal basis for a d-dimensional quantum 
system, and so does {\k y ) : k £ Z^} of Y. Furthermore, 
they are mutually unbiased to each other, that is, for any 
k, k' e Z d 

1(^101 = ^- 

In our protocol, two MUB measurements, X = 
{\k x )(k x \ : k S Z d } and Y = {\k y )(k y \ : k £ 1 d }, are 
alternatively used. 

Let us construct a three-party entangled state 



!*(«)) 



XYY 



J2 l*)K>, (5) 

s-\-t-\-u—OL (mod d) 



where a G 1i d . Then we can readily obtain 

d-l 



!*(«)) 



liii) if is odd, 



XYl' 



= < 



d-l 



j(j-2-a) 



liu) if d is even. 



(6) 

Similarly we can derive an entangled state \^{&))xxx 
as follows: 



!*(«)> 



^ |Sx)|tx)|Wa;) 
a (mod d) 

d-l 



Vjj)- 



(7) 



It is easy to check that |\E , (l)) xy y and 1^(0)} xxx are 
the same for d = 2, and furthermore both ^(a^xyy an( f 
|\['(a)) XX j ( - are essentially equivalent to the standard d- 
dimensional GHZ state up to local unitary operations. 
In particular, it follows from Eqs. (O and ([7]) that 



l*(a))xyy = (U®I®I)\V(a)) xxx 
1 
d 



E 

s-\-t-\-u— a. (mod > 



U\s x )\t x )\u x ), (8) 



where 



if d is odd, 



[/ = < 



3=0 

d-l 



(9) 



XJ^'u 2 )|j)(j| if <i is even. 



In this point of view, we call these states the GHZ-like 
states. 

We now show that |\I/(Q;))j^ yy is the uniquely deter- 
mined common eigenstate of XYY, YXY and YYX 



with respect to eigenvalue w° if d is odd (uj a+1 if d is 
even). Let d be odd and assume that an arbitrary 3- 
qudit pure state \4>) — J2j k 1 a jki\jkl) satisfies 

XYY\4>) = YXY\(f)) = YYX\(f>) = uj a \4>) ■ (10) 

It follows from straightforward calculations that 



d-l 



jO'-l-a) 



Vd 



\jjj) = |*(a)) 



XYY' 



(11) 



J=0 



Similarly, if d is even, we also have 

d-l 

^ jU ~ 2 ~ a) m = i*(«)w (i 2 ) 



J=0 



Moreover, we can see that |^ / (a)) xyy = |^ r (a)) yxy = 
|^(o!))yYX - Hence, if Alice, Bob and Charlie measure 
l*(«))xyy b y Xyy > YXY, or Y~Y"X, then they obtain 
outcomes s, t and u satisfying that s + t + u = a (mod d), 
respectively. 



III. OUR PROTOCOL 

In QSS, Bob and Charlie obtain the Alice's private 
key from the correlation of outcomes, given by measur- 
ing a three-party entangled quantum systems. In fact, 
Bob and Charlie can get Alice's information by the joint 
measurement such as Bell measurement if they are to- 
gether at same place. This is the same situation as QKD 
like BB84 or EPR protocols @, [T3] . 

However, QSS protocol proceeds in the condition that 
they are far away from each other and measure their 
states locally. Non-locality and entanglement distributed 
between them are, after all, used to give a correlation 
between their classical outcomes by local measurements. 
Therefore, one of the most important problem in QSS is 
how Alice sends an entangled state to Bob and Charlie 
securely against eavesdropping by any exterior Eve and 
the intercept-and-resend attack by an interior dishonest 
person. In order to construct the QSS protocol satisfy- 
ing the above conditions, we use two MUB measurements 
given m Section HH 



1. Alice prepares a GHZ-like state, |^(o;)) 



XYY' 



and 



sends Bob and Charlie the last two particles, re- 
spectively. Alice repeats this step 2n times, and 
all participants store their particles in the order re- 
ceived. 

2. Bob and Charlie publicly announce the fact that 
they have already received all 2n particles from Al- 
ice, and then they measure their own qudits after 
deciding one of measurement directions X and Y 
randomly. 

3. Alice informs Bob and Charlie a randomly chosen 
2n bit string b, each entry of which is either or 
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State 


Bob 


Charlie 


Alice 


l*(«)>xyy 


Y 


Y 


X 


\^{<*))xyy 


Y 


X 


Y 


\*H)xyy 


X 


Y 


Y 


\^{<*))xyy 


X 


X 


UXU^ 



TABLE I: Alice's measurements corresponding to Bob's and 
Charlie's: U is the local unitary operation which transforms 
into \ f(a)) XYY in Eq. @. 



1. Then for i-th particles corresponding to bj = 1 
Alice requires Bob and Charlie to announce their 
measurement outcomes and directions in the order 
randomly determined as either [(i) Bob's outcome, 
(ii) Charlie's outcome, (hi) Charlie's direction, (iv) 
Bob's direction] or [(i) Charlie's outcome, (ii) Bob's 
outcome, (hi) Bob's direction, (iv) Charlie's direc- 
tion] . 

4. Alice properly measures her i-th particles corre- 
sponding to hi = 1 in the direction correlated with 
measurement of Bob and Charlie as in TABLE fl] 

5. If Alice finds any error from all participants' mea- 
surement outcomes in Step [4] then she aborts the 
protocol. Otherwise, they discard the particles for 
the test, and Alice lets Bob and Charlie announce 
their measurement directions for the particles left 
after the test. 

6. Alice properly measures her particles in the direc- 
tion perfectly correlated with measurement of Bob 
and Charlie as in TABLE Q] 

7. When Bob and Charlie collaborate to obtain Alice's 
information, Alice announces the hidden value a to 
Bob and Charlie. Then they can derive her private 
key string from the outcome correlation, s + t + u = 
a (mod d). 

Note that it is possible to use a string consisting of 
different hidden values for GHZ-like states, instead of 
the fixed a. 



IV. SECURITY 
A. Eavesdropping by exterior Eve 

In section ILT1 we have shown that \^{o)) X yy ^ s ^ ne 
unique pure three-party quantum state invariant under 
operators XYY, YXY and YYX simultaneously, with 
respect to an eigenvalue ui a if d is odd (uj a+1 if d is even). 

This means that if 

d-i 

I*) = J2 a 3ki\jkl) ABC \R 3 ki) E (13) 

j,k,l=0 



successfully passes the test of our protocol then 
should be a product state 

XYY ® \R) E - ( 14 ) 

In other words, after the test of our protocol, Eve is per- 
fectly separated and the perfect correlation, s + t + u = a 
(mod d), is securely preserved among all participants. 
Therefore, our protocol is secure against any exterior 
Eve's eavesdropping. 



B. Intercept-and-resend attack by interior 
dishonest party 

In this section, we consider the case that one of re- 
ceivers Bob and Charlie changes his mind and tries to 
obtain Alice's private key alone. Suppose a dishonest 
person (Bob) performs the intercept-and-resend attack 
on Charlie's particles. 

First, Bob can intercept, measure by predicting the 
measurement direction of Charlie, and resend the col- 
lapsed state to him. If Bob and Charlie measure Char- 
lie's original states in the same directions, then Bob can 
obtain the information about Alice's private key alone af- 
ter knowing the hidden value a. Although Bob performs 
measurements in the directions different from Charlie, his 
attacks can be unexposed with probability 1/d. There- 
fore, the exposed probability is not less than 1 — (4^-) 
during the test procedure and we can find out that the 
higher dimensional system provides us with the better 
security for QSS protocol. This is due to the fact that 
the number of eigenspaces of measurement linearly in- 
creases as the dimension of system gets higher, and that 
it is also difficult for Bob to obtain the same result as 
Charlie's when n is sufficiently large. 

We now assume that Bob possesses all states Alice sent 
and gives Charlie one sides of e?-dimensional bipartite 
(maximally entangled) states. In Step Oof our protocol, 
the measurement directions and outcomes of Bob and 
Charlie are alternately announced in a specific way. As 
in [ll[ , this procedure prevent dishonest Bob from cheat- 
ing the other members. Therefore, our protocol is also 
secure against intercept-and-resend attacks by an interior 
dishonest member. 



V. CONCLUSIONS 

We have presented a 3-party d-level QSS protocol. 
To construct a QSS protocol on arbitrary d-dimensional 
quantum systems, we have derived MUBs on Hilbcrt 
space C d <£> C rf <£> C d , which guarantees the security of 
our protocol. Especially, with the explicit formula for 
the exposed probability, we have shown that the higher 
dimensional system assures the better security for QSS 
protocol. 
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In addition to the security, our protocol is more effi- 
cient than any other protocols since the number of dis- 
carding entangled states is minimized in our protocol by 
controlling Alice's measurements according to measure- 
ments of Bob and Charlie. Furthermore, in contrast to 
the previously known QSS protocols, Bob and Charlie 
have no information about Alice's private key because of 
the hidden value or string a, although he is not detected 
in the middle of test. 



Korea government (MOST) (No. R01-2006-000-10698- 
0), and S.L. was supported by the Korea Research 
Foundation Grant funded by the Korean Government 
(MOEHRD, Basic Research Promotion Fund) (KRF- 
2007-331-C00049). 



Acknowledgments 

D.P.C. was supported by the Korea Science and En- 
gineering Foundation (KOSEF) grant funded by the 



[1] A. Shamir, Comm. ACM. 22, 612 (1979). 

[2] G.R. Blakley, in proceedings of the National Computer 

Conference 48, 313 (1979). 
[3] M. Hillery, V. Buzek and A. Berthiaume, Phys. Rev. A 

59, 1829 (1999). 
[4] D.M. Greenberger, MA. Home, and A. Zeilinger, in 

Bell's Theorem, Quantum Theory, and Conceptions of 

the Universe, edited by M. Kafatos (Kluwer, Dordrecht, 

1989), p. 69. 

[5] A. Cabello, Phys. Rev. Lett 89, 100402 (2002). 
[6] W.K. Wootters and B.D. Fields, Ann. Phys. 191, 363 
(1989). 



[7] H. Barnum, quant-ph/0205155 

[8] A. Klappenecker and M. Rotteler, in Finite Fields and 
Applications: 7th International Conference Fql, Lecture 
Notes in Computer Science Vol. 2948 (Springer, Berlin, 
2004), pp. 137-144, e-print [quant-ph /0309i20] 
[9] C. Bennett and G. Brassard, Conference on Computers, 
Systems, and Signal Processing, Bangalore, India, IEEE, 
New York, (1984). 

[10] A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991). 

[11] A. Karlsson, M. Koashi, and N. Imoto, Phys. Rev. A 59, 
162 (1999). 



